# Verify a download | Sophia Stack X

Source: https://sophiastack.sophiaxt.com/verify

# Verify a download

Every release has one list, `latest.json`, that names each file and its SHA-256. SOPHIA XT signs that list with an Ed25519 key. Check the signature once, then check any file against the list. If both match, the file is the one we published.

The release key is:

```
1d6b0c095ceca8b2e6ca84c4cc11413fc6906fb5384b9e703ed98e2a98cd0a22
```

It is built into every copy of the program and into `install.sh`. The same key, in the form openssl reads, is at [/download/release-key.pem](/download/release-key.pem).

## On Linux, before running the installer

You need openssl 3.0 or newer (`openssl version`).

```
B=https://sophiastack.sophiaxt.com/download
curl -fsSLO $B/install.sh -O $B/latest.json -O $B/latest.json.sig.bin -O $B/release-key.pem

# 1. The list is signed by SOPHIA XT. Prints "Signature Verified Successfully".
openssl pkeyutl -verify -pubin -inkey release-key.pem -rawin -in latest.json -sigfile latest.json.sig.bin

# 2. The script matches the list. The two hashes must be the same.
sha256sum install.sh
grep -A1 '"install.sh"' latest.json

# 3. Read it, then run it.
less install.sh
sudo sh install.sh --domain example.com --tls-email you@example.com
```

Compare the key inside `release-key.pem` with the key above if you got the file from the same place as the download. `install.sh` then repeats the same checks for the program it downloads.

## Checking a program

Do steps 1 and 2 with the program's file name in place of `install.sh`:

```
sha256sum sophia-linux-x86_64
grep -A1 '"sophia-linux-x86_64"' latest.json
```

On a Mac, use `shasum -a 256` in place of `sha256sum`. The openssl that ships with macOS can't check Ed25519 signatures; check the signature on any machine with openssl 3, then compare hashes on the Mac.

On Windows, in PowerShell:

```
Get-FileHash sophia-windows-x86_64.exe -Algorithm SHA256
```

Compare the result with the entry in `latest.json`.

## What the signature does and doesn't cover

A good signature means the list came from whoever holds the SOPHIA XT release key, and the matching hash means the file is the one on that list. It does not mean an outside party has audited the code. The open-source parts are listed in [THIRD-PARTY-NOTICES.txt](/download/THIRD-PARTY-NOTICES.txt).

Updates use the same check: `sophia update --latest` refuses any list that is not signed by the key built into the program, and any program that does not match the list.